ISO/IEC 27001 Information Security Management

Safeguarding your information with
I.S. EN ISO/IEC 27001

I.S. EN ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of an organisation. It includes requirements for the assessment and treatment of information security risks tailored to organisational needs. 

The requirements of I.S. EN ISO/IEC 27001 are generic and applicable to all organisations, regardless of size, sector, or complexity. 

NSAI provides accredited certification to I.S. EN ISO/IEC 27001, offering independent assurance that an organisation’s information security management system conforms to internationally recognised best practice. 

Overview of I.S. EN ISO/IEC 27001:2023

I.S. EN ISO/IEC 27001:2023 reflects current information security and cybersecurity practices. 

Annex A of the standard contains 93 information security controls organised under four themes: 

• Organisational controls

• People controls 

• Physical controls 

• Technological controls 

The standard adopts a risk‑based approach, requiring organisations to identify, assess, and treat information security risks in line with business objectives and stakeholder expectations. 

Irish (I.S.), European (EN), and international (ISO) designations 

In Ireland, ISO/IEC 27001:2022 is adopted as a national standard and published as I.S. EN ISO/IEC 27001:2023. 

• ISO/IEC 27001:2022 is the international standard published by ISO/IEC
  I.S. EN ISO/IEC 27001:2023 is the identical Irish and European adoption of the same standard 

There are no material differences between the content, requirements, or controls of ISO/IEC 27001:2022 and I.S. EN ISO/IEC 27001:2023. 

Certification to ISO/IEC 27001:2022 is therefore equivalent to certification to I.S. EN ISO/IEC 27001:2023, and certification to either designation provides the same level of assurance and recognition. 

NSAI certification is issued against the applicable standard designation while confirming conformity to the full requirements of ISO/IEC 27001. 

What I.S. EN ISO/IEC 27001 requires

Certification to I.S. EN ISO/IEC 27001 requires organisations to demonstrate that they have: 

• Defined the scope of their information security management system 

• Identified information security risks and opportunities 

• Implemented appropriate controls through a documented risk treatment process 

• Assigned roles, responsibilities, and governance arrangements 

• Established processes for monitoring, internal audit, and continual improvement 

Benefits of I.S. EN ISO/IEC 27001 certification

Compliance and trust 

• Protect sensitive and confidential information 

• Demonstrate conformity with legal, regulatory, and contractual requirements 

• Strengthen confidence among customers and stakeholders 

Market advantage 

• Enhance credibility when tendering for contracts 

• Support entry into regulated and international markets 

• Demonstrate alignment with recognised best practice 

Risk and cost management 

• Reduce the likelihood and impact of security incidents 

• Apply proportionate and effective security controls 

• Minimise financial, operational, and reputational impact 

Organisational governance 

• Clarify responsibilities for information security 

• Strengthen management oversight and decision‑making 

• Improve consistency of security‑related processes 

Relationship with data protection and GDPR

I.S. EN ISO/IEC 27001 can support organisations in managing information security risks relevant to personal data processing. While certification does not in itself demonstrate legal compliance, it can provide structured evidence of controls that contribute to meeting data protection obligations, including those under the EU General Data Protection Regulation (GDPR). 

The I.S. EN ISO/IEC 27001 certification process 

Certification with NSAI typically involves: 

1. Application and quotation 

2. Stage 1 audit (pre liminary assessment) 

3. Stage 2 audit (certification assessment) 

4. Ongoing surveillance audits 

5. Recertification at defined intervals 

Certification decisions are made independently in accordance with accreditation requirements. 

How to apply for certification 

Organisations may assess their readiness using the NSAI I.S. EN ISO/IEC 27001 self‑assessment questionnaire. 

To request a quotation for I.S. EN ISO/IEC 27001 certification services, please complete the NSAI Request for Quotation form available on our 'Need a Quote' page and return it to certification@nsai.ie 

Related Links:

European Commission - Protecton of personal data
Data Protection Commissioner - GDPR webpage

For further information see ISO/IEC 27003 ‘Information technology - Security techniques - Information security management system implementation guidance’

I.S. EN ISO/IEC 27001:2023 and ISO/IEC 27003 can be purchased at www.standards.ie